ALZip Buffer Overflow UNACEV2.DLL Lets Remote Users Cause Arbitrary Code to Be Executed
|
|
SecurityTracker Alert ID: 1014863
|
|
SecurityTracker URL: http://securitytracker.com/id?1014863
|
|
CVE Reference: CVE-2005-2856
(Links to External Site)
|
Updated: Jun 8 2008
|
Original Entry Date: Sep 7 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Secunia Research
|
Version(s): 6.1 beta and prior versions; 6.11 and prior Korean versions
|
Description: A vulnerability was reported in ALZip. A remote user can cause arbitrary code to be executed on the target user's system.
The UNACEV2.DLL component contains a buffer overflow. A remote user can create an ACE archive containing a file that has a specially
crafted filename. When the target user extracts the archive, the stack overlow will be triggered and arbitrary code will be executed.
The code will run with the privileges of the target user.
The vendor was notified on August 22, 2005.
Tan Chew Keong of
Secunia Research discovered this vulnerability.
|
Impact: A remote user can create an archive that, when processed by the target user, will cause arbitrary code to be executed on the target user's system. The code will run with the privileges of the target user.
|
Solution: The vendor has issued a fixed version (6.1 for International versions, 6.12 for Korean version).
|
Vendor URL: www.altools.net/Default.aspx?tabid=47 (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 7 Sep 2005 08:24:57 -0400
Subject: ALZip ACE Archive Handling Buffer Overflow
|
http://secunia.com/secunia_research/2005-41/advisory/
|
|
